European researchers are increasingly vocal about the significant hurdles they face in accessing crucial data from major social media platforms like TikTok, X (formerly Twitter), and Meta, despite legal mandates under the European Union’s Digital Services Act (DSA). This alleged stonewalling is hindering independent investigations into systemic risks, including the spread of disinformation that can profoundly impact democratic processes, as starkly illustrated by a controversial presidential election in Romania.
The Romanian Election: A Case Study in Digital Manipulation
In the pivotal weeks leading up to Romania’s November 2024 presidential election, an alarming trend emerged on TikTok. Accounts previously dedicated to innocuous topics such as fashion and beauty abruptly pivoted to promoting a relatively obscure politician, Călin Georgescu. Georgescu, known for his hard-line anti-immigration stance and propagation of antisemitic tropes, saw his content amass an astonishing 120 million views before the vote. This surge in visibility propelled Georgescu, who had consistently polled in the single digits, to a surprising first-round victory with 23 percent of the vote, sending shockwaves through the Romanian political landscape and international observer communities.
Monitoring these developments closely was Adriana Iamnitchi, Chair of Computational Social Sciences at Maastricht University, whose research focuses on disinformation campaigns. Iamnitchi and her team were particularly keen to understand the mechanisms behind the pro-Georgescu content, specifically how it was monetized through covert influencer marketing and politically charged livestreams on TikTok. Recognizing the potential for systemic manipulation, on October 28, 2025 – a month before Georgescu’s initial electoral success – Iamnitchi’s team formally applied for access to TikTok’s Application Programming Interface (API) under the provisions of the EU’s then-recently enacted Digital Services Act (DSA).
Their request, however, was denied. TikTok cited the researchers’ alleged failure to prove their status as established researchers, to adequately explain their commercial interests, and to meet stringent security requirements, as detailed by Iamnitchi in a subsequent blog post reflecting on the rejection.
Despite denying access to independent researchers, TikTok itself later acknowledged significant issues on its platform. Two months after the initial vote, the company announced it had flagged 116,000 accounts as potentially compromised and subsequently took action against over 27,000 fake accounts. These accounts were identified as part of a coordinated network, operated by an undisclosed "fake engagement vendor," actively promoting Georgescu and his party, the Alliance for the Union of Romanians (AUR). TikTok stated it could not identify the operators or the origin of this network.
The fallout from the manipulated election was substantial. The first round of voting was ultimately annulled by Romania’s Constitutional Court. In the subsequent runoff election held in May 2025, independent candidate and former Bucharest mayor Nicușor Dan defeated AUR’s George Simion, who had taken over party leadership after Georgescu was legally barred from running again. Georgescu vehemently condemned the annulment on his YouTube channel, calling it "practically a formalized coup d’état" by the Constitutional Court.
Further complicating the narrative, declassified Romanian intelligence reports later indicated that Georgescu had "benefited" from massive exposure and preferential treatment on TikTok, and critically, alleged that Russia had coordinated the online campaign aimed at securing his election. This revelation underscored the profound national security implications of platform manipulation and the urgent need for transparent data access.
Iamnitchi remains convinced that had her team gained access to TikTok’s data, they might have been able to identify the true orchestrators and beneficiaries of the pro-Georgescu content. "If you are a scholar interested in how social media shapes society, the past years have been tough," she wrote, lamenting the practical impossibility of researching critical societal impacts when the necessary data is privately held by powerful corporations.
The Digital Services Act: A Regulatory Framework Under Strain
The Digital Services Act (DSA), which became fully applicable to Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) in August 2023, was heralded as a landmark piece of legislation designed to make the digital space safer and more accountable. A cornerstone of the DSA is Article 40, which grants vetted researchers from credible institutions the legal right to access platform data, provided they can demonstrate its necessity for studying "systemic risks." These risks range from the dissemination of illegal content and threats to fundamental rights to the broader impact of recommender systems and algorithmic amplification.
However, two years after its implementation, researchers across Europe contend that the DSA’s promise remains largely unfulfilled. They describe encountering a labyrinth of obstacles, including outright denials, deliberate obfuscation, and convoluted application processes, that effectively impede their work. The issue, they argue, lies not with the scope of the law, which was broadened last year to enhance researcher access, but with its inconsistent and often restrictive implementation by the platforms themselves.
Barriers to Research: A Multifaceted Challenge
The challenges faced by researchers are manifold and deeply entrenched in the operational practices of social media companies.
- API Access and Data Cost: In recent years, platforms have progressively restricted public access to their data. Meta, for instance, phased out popular public access tools like CrowdTangle, replacing them with more controlled "content libraries." X, under new ownership, dramatically altered its API access, moving to a pay-per-use model that, according to Duncan Allen, a research officer at Democracy Reporting International (DRI) in Germany, can cost academics "hundreds of dollars a month." This financial barrier disproportionately affects academic institutions with limited budgets. Without comprehensive API access, what Iamnitchi terms the "black holes" in society’s understanding of how platforms recommend content, handle sensitive reports, and combat disinformation, continue to expand.
- Data Volume Limitations: Some platforms, like TikTok, impose daily caps on the number of posts a researcher account can pull. Allen notes that such limitations make it "impossible to study anything at scale," severely restricting the scope and depth of research into widespread phenomena like coordinated disinformation campaigns.
- Stringent Security Requirements: A significant hurdle for researchers applying under the DSA is meeting platforms’ often-exorbitant security requirements. Application forms vary, but many demand that data be stored on highly secure infrastructure, such as machines physically disconnected from the internet. Iamnitchi points out that such resources are simply unavailable to most universities, creating an insurmountable barrier for many legitimate research teams.
- Narrow Interpretation of Systemic Risk: Platforms are accused of applying a narrow interpretation of what constitutes a "systemic risk" that warrants data access, further limiting approved requests. This subjective assessment often clashes with researchers’ broader understanding of the societal impact of platform dynamics.
- Data Quality and Reproducibility: Even when approval is granted, the quality and consistency of the provided API data are often questionable. L. K. Seiling, coordinator of the DSA40 Collaboratory – a German initiative tracking 46 DSA applications – highlights that "there’s no guarantee that the data is good." API data can be difficult for colleagues to reproduce, undermining a "basic requirement of science" for verifying research findings.
The DSA40 Collaboratory’s data paints a stark picture: out of 46 tracked applications, only 20 were approved, while 14 were rejected. However, approval rates vary wildly between platforms. TikTok, for example, approved 11 out of 13 applications reported to the Collaboratory, suggesting a relatively higher rate of compliance, at least for the applications tracked. In stark contrast, X rejected 11 out of 23 applications, indicating a more restrictive approach. Seiling cautions that the true rejection rate is likely higher, as the tracker relies on voluntary reporting from researchers, many of whom may not report their denials due to frustration or a lack of structured incentive. "There’s no structured advantage for researchers to use this pathway," Seiling concluded, adding that "Data access as it’s set up right now tries to disincentivize researchers."
Platform Responses and Researcher Frustrations
Social media companies maintain that they are working to comply with DSA mandates, albeit with caveats. A TikTok spokesperson informed WIRED that the company has granted over 1,500 research teams access to its tools and approved 130 applications in the EU in the latter half of the previous year. They stated that their daily quota of 1,000 API requests allows researchers to pull up to 100,000 video and comment records daily, or up to 2 million follower records, considering these tools compliant with the DSA. TikTok also expressed openness to "further public guidance."
Meta, for its part, asserted that its new Meta Content Library and API, replacing CrowdTangle, are "the most comprehensive research tools to date." A spokesperson highlighted that these tools cover Facebook, Instagram, WhatsApp Channels, and Threads, incorporating "robust privacy protections," and are available for application by qualified nonprofit researchers, including journalists.
However, researchers like Iamnitchi and Allen often find these statements insufficient in practice. They frequently resort to less efficient methods, such as web scraping, on platforms where it is permitted. While sophisticated tools exist, scraping is "not very comprehensive," according to Allen. It often fails to capture complete follower lists, making the mapping of complex, coordinated disinformation networks exceedingly difficult.
Legal Battles and Regulatory Pressure: The Case of X
The persistent lack of satisfactory data access has pushed some researchers to pursue legal avenues. Democracy Reporting International (DRI), alongside the Society for Civil Rights, initiated legal action against X. In April 2024, they applied for API access to study political discourse ahead of Germany’s federal election, a request X rejected in November, prompting DRI to file a lawsuit in February 2025. The court sided with DRI, a ruling seen as a potential precedent-setter.
Yet, the legal challenges continued. Months later, DRI found itself back in court after X denied access for research preceding Hungary’s election. This case nearly collapsed when a Berlin court initially ruled that the researchers should have sued in Ireland, where X is based. DRI, however, successfully appealed this decision. Reflecting on the protracted legal battles, Allen noted, "EU law is still not uniformly applied." He highlighted the significant drain on time and energy, questioning whether such lawsuits are sustainable for every data access application.
The European Commission has not been idle. In December 2025, it imposed its first DSA penalty, fining X €120 million (approximately $137 million). A key reason for the fine was X’s creation of "unnecessary barriers" to researcher access, which the Commission deemed to "effectively undermine research into several risks in the European Union."
X, however, appealed the fine on February 20, 2026, labeling the Commission’s investigation "incomplete and superficial" and accusing the EU of "systemic breaches of rights of defence and basic due process requirements." Despite the appeal, the Commission recently accepted X’s action plan to rectify the researcher screening process. This plan mandates X to provide data free of charge, reduce processing times, and lift restrictions on data scraping. X has been given six months to implement these changes. Allen, while calling the plan "a step in the right direction," remains cautiously skeptical about its implementation, emphasizing the need for X to be more specific about improvements to its vetting process for DSA-qualified researchers.
Broader Implications for Democracy and Accountability
The ongoing struggle for data access has profound implications for democratic integrity, academic freedom, and the overall effectiveness of regulatory frameworks like the DSA. Independent research is vital for understanding the mechanisms of online influence, identifying foreign interference, and holding powerful platforms accountable for their impact on public discourse. When this research is stifled, societies operate in the dark, vulnerable to manipulation and the erosion of trust in democratic institutions. The Romanian election serves as a stark warning of how easily digital platforms can be weaponized to undermine electoral processes.
The European Commission itself has acknowledged the systemic nature of the problem, noting in another DSA investigation that Meta and TikTok "may have put in place burdensome procedures and tools for researchers to request access to public data," leading to partial or unreliable information. In response, the Commission initiated meetings with platforms in May to collaboratively develop a new standard for vetting researchers, signaling a concerted effort to streamline and standardize the data access process across the board.
The Road Ahead: Cautious Optimism for Enhanced Access
Late last year, the Commission also adopted a delegated act that expanded researchers’ access to nonpublic platform data. This is a significant development, allowing investigations into a broader range of risks, including illegal content, financial scams, and the intricate workings of recommender systems. While these new provisions have yet to be fully tested, researchers express cautious optimism.
The ability to access nonpublic data, such as an account’s full follower list, could be a game-changer for disinformation researchers. Allen explains that this level of detail provides a far clearer view of how coordinated attacks propagate online, enabling researchers to map out intricate networks of accounts, understand their interactions, and analyze how content is amplified. This deeper insight is crucial for developing effective countermeasures against sophisticated influence operations.
The ongoing tension between platform transparency and corporate control over data highlights a critical juncture in digital governance. While the DSA represents a bold regulatory step, its true impact hinges on rigorous enforcement and a genuine commitment from platforms to facilitate independent research. The coming months will be crucial in determining whether the legal frameworks can overcome the practical barriers and truly usher in an era of greater accountability and transparency in the digital sphere, safeguarding democratic processes from the persistent threats of online manipulation.
Leave a Reply